pwn 0.5.762 → 0.5.766

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20f94659af48e0dba30534ed36cfaf8942497dcc5851e346a44ef40c51abb130
-  data.tar.gz: 8f91abcce730d25f6721d89aa6389090aa572b40ffe7449cd419a874d15d1932
+  metadata.gz: 48f9dad90543bf3140d52f14058c9b59c0e011daa42b8729ff4614fb01b34d60
+  data.tar.gz: e04116b2e14a9f728a1a583762ad9395f4858dcad190211c05988e8e5d60830b
 SHA512:
-  metadata.gz: 8174ba5855b3cb25e41eabe9c34a57add502f6b1d52caef2809bd603e66eab5dd1a169e01e1e06feb5c745ffddaa817fbaae9748458933c35c727a5a9c18b736
-  data.tar.gz: 111e5b05d8ad0c54f82ba0ae1836fb9ab1f8f3c1845c992d2dbacf7a241286e6ea139c9714d91e58ee80a246a119bdadf59e71d6a0f65e30fc224b96a9de2b7a
+  metadata.gz: e10732fcb06f209fd72fa0518241143fb9dccd448fdbf75c0d78d0da155ef0206f2bd068906e4be0b8605e1a15d73a7f1844f1a10b9f756f0cc34ff3b788495d
+  data.tar.gz: 734bef29b1fb747424b676a0277095175b37816b6b7ca272dd3ff720ec36872ab69a7700afc10f74ba6542c7855282a97666ae6127e1bf8ccc66c78b8a5c3b1c

data/Gemfile

@@ -50,19 +50,19 @@ gem 'libusb', '0.8.0'
 gem 'luhn', '3.0.0'
 gem 'mail', '2.9.1'
 gem 'mcp', '1.7.0'
-gem 'meshtastic', '0.0.186'
+gem 'meshtastic', '0.0.187'
 gem 'metasm', '1.0.6'
 gem 'mongo', '2.26.0'
 gem 'msfrpc-client', '1.1.2'
 gem 'netaddr', '2.0.6'
-gem 'net-ldap', '0.20.0'
+gem 'net-ldap', '0.21.0'
 gem 'net-openvpn', '0.8.7'
 gem 'net-smtp', '0.5.2'
 gem 'nexpose', '7.3.0'
 gem 'nokogiri', '1.19.4'
 gem 'nokogiri-diff', '0.3.0'
 gem 'oily_png', '1.2.1'
-gem 'open3', '0.2.1'
+gem 'open3', '0.3.0'
 gem 'os', '1.1.4'
 gem 'ostruct', '0.6.3'
 gem 'packetfu', '2.0.0'
@@ -73,15 +73,15 @@ gem 'pry', '0.16.0'
 gem 'pry-doc', '1.7.0'
 gem 'rake', '13.4.2'
 gem 'rb-readline', '0.5.5'
-gem 'rbvmomi2', '3.10.0'
+gem 'rbvmomi2', '3.11.0'
 gem 'rdoc', '7.0.4'
 gem 'rest-client', '2.1.0'
 gem 'rex', '2.0.13'
-gem 'rmagick', '7.1.6'
+gem 'rmagick', '7.2.0'
 gem 'rqrcode', '3.2.0'
 gem 'rspec', '3.13.2'
 gem 'rtesseract', '3.1.4'
-gem 'rubocop', '1.91.0'
+gem 'rubocop', '1.92.0'
 gem 'rubocop-rake', '0.7.1'
 gem 'rubocop-rspec', '3.10.2'
 gem 'ruby-audio', '1.6.1'
@@ -89,9 +89,9 @@ gem 'ruby-nmap', '1.0.3'
 gem 'ruby-saml', '1.18.1'
 gem 'rvm', '1.11.3.9'
 gem 'savon', '2.17.5'
-gem 'selenium-devtools', '0.154.0'
-gem 'selenium-webdriver', '4.50.0'
-gem 'slack-ruby-client', '3.2.0'
+gem 'selenium-devtools', '0.155.0'
+gem 'selenium-webdriver', '4.51.0'
+gem 'slack-ruby-client', '3.3.0'
 gem 'socksify', '1.8.1'
 gem 'spreadsheet', '1.3.5'
 gem 'sqlite3', '2.9.6'

data/documentation/Banner.md

@@ -14,4 +14,22 @@ welcome-banner          # REPL command: redraw a random one
 
 Add your own: drop a module in `lib/pwn/banner/` implementing `self.get`.
 
+## pwn-ai startup pane
+
+The curses console starts with a white miniature derived directly from
+`PWN::Banner::WhiteRabbit.get`, without its dedication or wordmark. The full
+banner remains unchanged. The rabbit is centered and aspect-contained in the
+current pane: small panes use area-filtered 3×6 character strokes packed into
+ordinary 2×4 Braille text dots; when the original ASCII fits, it is displayed
+verbatim, centered without enlargement. This assumes typical 1:2 terminal cells.
+Small panes lose punctuation detail, and Braille dot spacing depends on the font;
+physically tiny panes cannot retain a recognizable rabbit. No image protocol,
+image file, graphics probe or runtime image library is used.
+
+No games or replays are computed until the animation pane first receives focus
+via Ctrl+T/Ctrl+X. That enables games for the console lifetime. Ctrl+G cycles
+games while focused; leaving the pane keeps the existing automatic animation,
+not the startup rabbit. Resizing, modal input priority and the mission draft
+retain their existing behavior. Monochrome terminals keep the same geometry.
+
 [← Home](Home.md)

data/documentation/Installation.md

@@ -202,6 +202,110 @@ without a per-job crontab line. Live Policy files (`policy.json`,
 `policy_traj.jsonl`) are created on first agent turn when `ai.agent.policy`
 is on.
 
+Schema `v8` seeds the enabled `session_cleanup` hygiene job, daily at 03:45
+in the scheduler's local timezone. First launch also seeds it through
+`PWN::Cron.install_defaults`. The bundled `etc/default_cron/session_cleanup.rb`
+is installed to `~/.pwn/cron/session_cleanup.rb`; managed copies refresh on
+subsequent launches/migrations, while unmarked custom helpers are preserved.
+An existing job named `session_cleanup` keeps its ID, schedule, enabled state,
+payload and native scheduler drop-ins. New jobs defer cleanup until their first
+scheduled time, rather than deleting during initial catch-up.
+
+Cleanup calls a session named only when its persisted metadata has
+`title_source: summary`, a nonblank title and summary, and a positive integer
+`summary_turns` cursor: the fields published after validated LLM title generation.
+Provisional first-request titles, manual titles, persona labels, aliases and
+historical embedded titles are not evidence of LLM summarization. Legacy records
+without provenance are unsummarized with `missing_summary_provenance`; invalid or
+incomplete metadata is unknown, never named. `/sessions list` and cleanup share
+`title_source`, `is_summarized`, `classification` and `title_reason`. Classification
+does not establish deletion safety: malformed records, symlinks and uncertain pin
+stores remain protected. Age alone does not preserve an unsummarized session.
+Version 5 backs up unreferenced unsummarized sessions before a guarded `Sessions.delete`
+call that bypasses the ordinary age pin. Current sessions and every known
+learning/mistake/memory reference remain protected. `/sessions list` exposes
+`dependencies` as an array of files **referencing this session** (empty when
+none), not files this session depends on. `dependency_errors` lists unknown,
+malformed or unsafe stores; cleanup fails closed when it is nonempty.
+The shared index follows defined structural fields, not ID-looking text.
+Dependency-backed sessions remain visible and resumable, not archived away.
+Vault/config/credential payloads and historical backups are not scanned.
+Same-user interactive PWN
+processes defer deletion because existing writers have no lifetime leases; this is a
+conservative guard, not a cross-process session lease. Inspect without deleting:
+`ruby ~/.pwn/cron/session_cleanup.rb --dry-run`.
+
+`--apply` backs up eligible transcript/metadata bytes under
+`~/.pwn/session_cleanup_archive/<run>/` (directories 0700, files 0600), outside
+`/sessions list`. Atomic, fsynced backups are SHA-256 verified before deletion;
+file identities/hashes, title classification, reference stores and process state
+are rechecked under per-ID/transcript locks. `ledger.json` records exact IDs,
+hashes, skips and completed deletions; dry-run JSON contains metadata only and
+creates no archive. Backups are for recovery, not an automatic reference
+resolver: referenced placeholders remain in the active list until a separately
+verified archive-aware lookup policy exists. No memory, learning or mistake
+records are rewritten. The process checks and advisory locks do not claim a
+transactional guarantee against arbitrary non-cooperating external writers.
+
+The cleanup-specific pins additionally preserve every session ID referenced in
+retained learning, mistake and durable memory stores, including non-gold learning
+and old resolved mistakes. References are schema-aware:
+
+| Store / writer | Session reference |
+| --- | --- |
+| `learning.jsonl` / Learning; `policy_traj.jsonl` / Policy; `open_goal.json` / OpenGoal | Top-level `session_id` |
+| `mistakes.json` / Mistakes | Each signature record's `sessions[]` and `verified_sessions[]`; signature keys are not session IDs |
+| `memory.json`, `memory.archive.json` / Learning.reflect, Memory | Exact `reflect_<session ID>_<8-hex lesson digest>` keys; arbitrary memory keys, values and source strings are not links |
+| `jobs/<12-hex job ID>.json` / Jobs | Top-level `session_id`; command, environment and job ID are not links |
+| `swarm/*/personas.json` / Swarm | Persona-to-session map values, not persona names or swarm IDs |
+| `curriculum/log.jsonl` / Curriculum | `practice` event's `data[].runs[].session_id`; other events' prose is not traversed |
+| `extrospection.json` / Extrospection | `auto_extrospect` observations' second tag in `['drift', session ID]`; manual/other tags and observation data are not links |
+| `engagements/*/facts.jsonl` / Swarm | Top-level `source_session` |
+| `findings.jsonl` / Findings | Top-level `session_id`; exact transcript/sidecar paths in `evidence_paths[]` and `poc_artifacts[]` |
+| Engagement evidence and recon ledgers / Findings, Recon | Exact transcript/sidecar paths in `path` or `evidence_path`; includes the legacy root `engagements/evidence.jsonl` |
+| `artifacts/manifest.jsonl` / ArtifactRegistry | Top-level `session` and exact transcript/sidecar `source_path`; `kind: swarm-bus` uses `session` for a swarm ID, not session provenance |
+| `artifacts/<session ID>/index.jsonl`, `engagement-memory.json` | Session ownership from that exact directory; index `src` may also reference a transcript/sidecar |
+| `embeddings/<session ID>.db`, `sessions/<session ID>/trace.jsonl` | Ownership from that exact filename/directory, not database contents or trace tool payloads |
+
+IDs must be complete canonical values, not substrings or whitespace-normalized
+tokens. Only known evidence/source path fields pointing directly into the
+configured sessions directory are path references. There is currently no
+cross-session link field in transcript or title metadata schemas: listing,
+recalling, quoting JSON, or mentioning a session never pins it, including when
+`sessions_list` output is saved repeatedly. Self listings do not create pins.
+
+The index also validates the JSON containers in policy, preference, sentinel,
+skill-review and KPI stores, run checkpoints, mission ledgers, swarm bus/solve
+records, curriculum model/cooldown maps, engagement descriptors/hosts/scans and
+binary facts. These writers do **not** persist session ownership links; their
+arbitrary payloads, prompts, run/job IDs and user-selected labels must not be
+interpreted as such. Unknown JSON stores within the indexed directories are
+reported as uncertainty rather than silently ignored. Adding a new reference
+schema requires auditing its writer/callers and adding positive and negative
+fixtures, not a recursive key-name or text search. Vaults, loot payloads, arbitrary
+artifact content and backups remain outside this index.
+
+Native scalar tool `step_reward` fields are recognized;
+unknown transcript fields remain protected.
+
+`/sessions list` reads all transcript files afresh, not just cleanup candidates.
+In cleanup output, `unnamed` includes protected sessions; `candidate_ids` excludes
+them. Active sessions hold shared OS locks on permanent per-ID cleanup lock
+files; cleanup takes an exclusive nonblocking lock on the same inode before
+rechecking, backing up and deleting. An active A does not retain inactive B.
+CLI/REPL activation and resume transfer ownership, exit releases it, nested
+Loop requests and title writers hold independent leases, and crashes release
+descriptors automatically. Stale lock contents or reused PIDs confer no ownership.
+Never unlink lock files: that would split the synchronization inode.
+
+Old installed processes cannot be upgraded by refreshing the cron helper alone.
+`legacy_owners` reports launchers without the held PID/start-identity capability
+marker; `unknown_legacy_ownership` means their in-memory session IDs are unknown,
+not that every session is active. Ask the operator to identify/quiesce those
+writers and restart using the updated source or deployed version before deleting
+ambiguous candidates. Do not infer active IDs from mtimes, titles or process-name
+matches, and do not bypass reference/summary guards. No config migration is needed.
+
 From a checkout:
 
 ```bash

data/documentation/Reinforcement-Learning.md

@@ -1,5 +1,85 @@
 # Reinforcement Learning in pwn-ai
 
+## Retained learning evidence and session cleanup
+
+Learning outcomes can retain a versioned `evidence_ref` (`version`, `id`,
+`sha256`) pointing to `~/.pwn/learning/evidence/<sha256>.json`. The existing
+`session_id` remains provenance. It ceases to pin a source transcript only
+after the artifact is readable, hash-valid, schema-valid, and its complete
+redacted transcript matches the unchanged source. A marker alone is not enough.
+Missing, modified, malformed or conflicting evidence does not authorize cleanup.
+Other stores, including mistakes, reflection memory and disputed learning,
+continue to pin their source sessions. Evidence files are never session-cleanup
+candidates; the dependency index exposes their referenced-by edges separately.
+
+No reliable turn-to-outcome boundary exists in legacy learning rows. Migration
+therefore preserves **every persisted transcript row**, including requests,
+tool actions, observations, results, timestamps and extra fields, with source
+session provenance and a SHA-256 of the original bytes. It uses the existing
+credential-pattern redactor, not a model or Vault, and does not summarize.
+Already compacted source content cannot be reconstructed; external artifact
+references stay references, and those artifacts must still be retained.
+
+Use the existing `learning_gc_stores` tool with
+`{"operation":"evidence_plan","dry_run":true}` for a read-only count/size
+report. This operation does not invoke store GC. The equivalent Ruby API in
+the existing `pwn` console is:
+
+```ruby
+PWN::AI::Agent::Learning.migrate_evidence(dry_run: true)
+```
+
+After reviewing the plan and explicitly approving writes, stop old installed
+PWN processes, scheduled maintenance and external editors first. Deploy the
+matching source before restarting: legacy installed writers do not participate
+in the new lock. Then use `learning_gc_stores` with
+`{"operation":"evidence_apply","dry_run":false}`, or
+`PWN::AI::Agent::Learning.migrate_evidence(dry_run: false)`.
+**Neither operation deletes sessions.** Review a separate session-cleanup
+dry run afterward; named/active/uncertain sessions remain protected by that
+cleanup policy. Do not infer session-count reduction from an evidence migration.
+
+Artifacts deduplicate by content hash. Files use 0600 and new directories 0700.
+Atomic, fsynced writes/readback precede the learning-index replacement. Original
+learning bytes and prepared/committed ledgers live under
+`~/.pwn/learning/migrations/`, outside legacy backup pruning. Core learning
+writers share a reentrant advisory lock; optimistic byte checks additionally
+reject observed source/index changes. These locks cannot coordinate arbitrary
+external editors or old installed versions: apply requires a quiescent store.
+Interrupted precommit runs leave original references intact and can be retried;
+an interruption after index replacement can leave a prepared ledger with a
+fully usable verified index. No partial artifact or staging file releases a pin.
+
+Before any source deletion, an unchanged migration can be rolled back with
+`PWN::AI::Agent::Learning.rollback_evidence(migration: '<ledger SHA-256 ID>')`,
+or tool operation `evidence_rollback` with the same `migration` field. Rollback
+verifies backup/index hashes and refuses later edits or absent/changed sources;
+it never overwrites concurrent learning. Keep recovery files private. They
+retain the exact original learning bytes, which can include legacy sensitive
+data. This is not an evidence garbage collector or a credential-store migration.
+
+Consumer audit: `Sessions.load` supplies verified evidence only when the legacy
+source is absent, keeping all existing ID-only consumers compatible. This covers
+`Learning` export_finetune, reflect, fold_judge_into_metrics,
+recover_predicted_from_session, infer_success, compress_exemplar,
+build_skill_from_session and requeue_conflicted; `Reward` run_verification,
+record_verification, request_verification and load_trace; `Curriculum`
+offline_judge and self_play; `Mistakes` previous_user/previous_assistant;
+`Memory.session_turns`; `tools/sessions.rb`; and REPL session-goal lookup.
+`Sessions.export` now uses that resolver too. `Curriculum.offline_judge` also
+discovers retained evidence outcomes after directory cleanup (outcome timestamp
+is its archived-session age). Invalid evidence raises at the resolver rather
+than masquerading as an empty transcript; existing consumer error/drop reporting
+continues to apply, with a metadata-only diagnostic when evidence cannot resolve.
+Reward's PRM annotation writer uses `Learning.annotate_evidence` when the source
+is absent: integer step rewards create a new content-hashed snapshot and replace
+references under the same backup/ledger/lock protocol. Supporting content and the
+old artifact remain unchanged; no session is recreated. Annotation rollback can
+restore verified prior evidence references even after original-session cleanup.
+DPO export already consumes self-contained preference
+pairs, not session files. New module/autoload/gemspec entries are unnecessary:
+the implementation extends existing paired modules.
+
 pwn-ai learns while you work. Most of that learning stays **in context**: the
 agent writes what happened to disk and puts the useful bits back into the next
 prompt. On a host **with a trainer and a GPU**, the same data can also train a

data/documentation/pwn-REPL.md

@@ -16,6 +16,46 @@ commands.
 
 ## Custom commands
 
+### pwn-ai session titles
+
+`/sessions list` shows stable IDs and titles of at most seven
+whitespace-separated words, matching the SESSION pane. The first request seeds
+a provisional title; the currently active LLM provider and selected model produce a concise conversation title
+after completed turns, with a deterministic seven-word fallback cap. The limit
+also applies to explicit titles. It does not shorten requests or apply to the
+rolling conversation summary.
+
+Title generation runs asynchronously after completed turns, never during drawing
+or keystrokes. It uses the previous overall summary plus new conversation turns,
+without changing the active provider or falling back to a different model. Missing
+credentials or failed/invalid responses retain the prior or provisional title;
+background title work never starts interactive authentication. Artifact summaries
+retain their separate local-only routing policy.
+
+Existing overlong titles are normalized when read, without rewriting transcripts
+or metadata merely to list them. `/sessions resume <title-or-id>`
+accepts the exact displayed title, optionally quoted. Internal quotes
+and Unicode whitespace are supported. If shortened titles collide, use the
+stable ID shown in the ambiguity message; IDs and transcript filenames do not
+change.
+Previously displayed titles remain resume aliases when a background summary
+renames the session, so a name copied from the list does not expire while typing.
+Aliases shared by multiple sessions are ambiguous too; use a stable ID.
+
+`dependencies` means **referenced by**: files containing defined structural
+references to that session. Transcript prose, prompts, tool results and quoted
+JSON—including previous `/sessions list` output—are not dependencies. An empty
+array means no known structural references; `dependency_errors` separately
+reports uncertainty and blocks scheduled cleanup. Dependency-backed sessions
+stay visible and resumable. See Installation's session-cleanup schema table.
+`title_source`, `is_summarized`, `classification` and `title_reason` expose the
+same strict provenance used by cleanup. Only persisted `summary` provenance with
+a nonblank summary/title and positive integer summary cursor counts as named.
+Provisional, manual, persona, historical and alias titles do not prove LLM work;
+legacy records explicitly report missing provenance. Unknown/malformed metadata
+is protected without being called summarized. Neither listing nor cleanup calls
+the LLM to manufacture provenance.
+
 | Command | Implemented in | Purpose |
 |---|---|---|
 | `pwn-ai` | `Agent::Loop` | Enter the AI agent TUI |
@@ -60,6 +100,40 @@ History includes messages and slash commands, skips blank lines and consecutive
 duplicates, and keeps the latest 100 entries in memory for the current pwn-mesh
 session only; it is not written to disk.
 
+### Message transport labels
+
+Each CONVERSATION header ends with its direction and the transport used for
+that individual message: `· RX via MQTT`, `· TX via Serial`, `· RX via Bluetooth`,
+or `· TX via TCP`. In `auto` mode this is the resolved connection, not the
+configured `auto` value. Received messages retain the subscribing transport's
+origin through queued rendering, even if the current transport changes.
+Missing origin metadata is shown as `Unknown`, not guessed from the current pin.
+
+Headers use `timestamp encryption · SHORT NAME · source path · destination path · direction via transport`,
+with exactly one space on either side of each `·`. RX uses the sender's
+`User.short_name` (`shortName` in JSON); TX uses the sending local node's User,
+never the destination's name. Device connections use their NodeInfo/NODEINFO
+inventory. MQTT learns NODEINFO announcements in a bounded, connection-local
+inventory (up to 1000 users), including the sending identity if advertised.
+Names are captured with each message, so later inventory or binding changes do
+not rename queued messages. Missing or blank short names omit that field and
+its separator; long names, node-ID fragments and gateway names are not substitutes.
+ANSI CSI sequences are removed, control/newline characters and literal `·` in
+names become spaces, and surrounding Unicode whitespace is trimmed. Other
+Unicode text and internal spaces are retained. Names are labels, not authenticated identities.
+
+For example (placeholder node IDs):
+
+```text
+2026-01-02 03:04:05+0000 🔍 · PEER · US/CA/2/e/LongFast/!aabbccdd · US/CA/2/e/LongFast/# · RX via MQTT
+2026-01-02 03:04:06+0000 🔍 · SELF · US/CA/2/e/LongFast/!bbccddee (ME) · US/CA/2/e/LongFast/# · TX via Serial
+```
+
+The timestamp, encryption indicator, source/destination paths, channel and
+`(ME)` marker keep their existing meaning. The suffix identifies the local
+client connection, not every RF or broker hop. A TX header means local transport
+submission; it does not confirm over-the-air delivery or peer receipt.
+
 ### Encrypted DMs and key discovery
 
 On serial, Bluetooth, or TCP, a DM checks the destination's public key in the

data/etc/default_cron/session_cleanup.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+# PWN managed default: session_cleanup v6
+# No provider calls or broad store GC. Unsummarized candidates are backed up first.
+require 'pwn'
+require 'json'
+require 'fileutils'
+require 'time'
+require 'digest'
+require 'securerandom'
+
+module PWN
+  # Provenance-based session cleanup, shared by seeded cron payloads.
+  module SessionCleanup
+    VERSION = 6
+
+    def self.classify(path, id)
+      return :unknown unless path == File.join(PWN::Sessions.sessions_dir, "#{id}.jsonl")
+
+      PWN::Sessions.title_status(session_id: id)[:classification]
+    end
+
+    # Compatibility discovery only: upgraded launchers never block unrelated
+    # sessions. Legacy in-memory IDs cannot safely be inferred from recent mtimes.
+    def self.legacy_owners(proc_root)
+      return [{ error: 'process_inventory_unavailable' }] unless File.directory?(proc_root)
+
+      Dir.glob(File.join(proc_root, '[0-9]*')).filter_map do |dir|
+        next if File.basename(dir).to_i == Process.pid
+        next unless File.stat(dir).uid == Process.uid
+
+        argv = File.binread(File.join(dir, 'cmdline')).split("\0")
+        next unless pwn_launcher?(argv, dir)
+        next if tracked_owner?(dir)
+
+        { pid: File.basename(dir).to_i, reason: 'legacy_session_ownership_unknown' }
+      rescue Errno::ENOENT, Errno::ESRCH
+        nil
+      rescue IOError, SystemCallError
+        { pid: File.basename(dir).to_i, reason: 'ownership_unreadable' }
+      end
+    rescue IOError, SystemCallError
+      [{ error: 'process_inventory_unreadable' }]
+    end
+
+    def self.pwn_launcher?(argv, dir)
+      executable = %r{\A(?:[^\s]*/)?pwn(?:-[a-zA-Z0-9_-]+)?\z}
+      return true if argv.first.to_s.match?(executable)
+      return false unless argv.first.to_s.match?(%r{\A(?:[^\s]*/)?ruby[\d.]*(?:\s|\z)})
+      return false unless File.basename(File.readlink(File.join(dir, 'exe'))).match?(/\Aruby[\d.]*\z/)
+      return true if argv.first.to_s.match?(%r{\A\S*ruby[\d.]*\s+(?:[^\s]*/)?pwn(?:-[a-zA-Z0-9_-]+)?\z})
+
+      args = argv.drop(1)
+      while args.first&.start_with?('-')
+        option = args.shift
+        break if option == '--'
+        break args.clear if option.start_with?('-e')
+
+        args.shift if %w[-I -r -C -E -F].include?(option)
+      end
+      args.first.to_s.match?(executable)
+    end
+
+    def self.tracked_owner?(dir)
+      return false unless File.file?(File.join(dir, 'stat'))
+
+      start = File.read(File.join(dir, 'stat')).split(') ').last.split[19]
+      # fdinfo proves this process holds the locked open-file description, not
+      # merely an unlocked descriptor to another process's marker. Forked tool
+      # workers inherit that capability and the precise session leases; they
+      # must not be mistaken for untracked legacy launchers. A reused PID alone
+      # has neither descriptor. Marker filenames bind the original PID/start.
+      tracked = Dir.glob(File.join(dir, 'fd', '*')).any? do |fd|
+        marker = File.readlink(fd)
+        next false unless File.basename(marker).match?(/\A\.activity-owner-\d+-\d+\.lock\z/)
+
+        info = File.read(File.join(dir, 'fdinfo', File.basename(fd)))
+        info.match?(/^lock:\s+\d+:\s+FLOCK\s+ADVISORY\s+WRITE\s/)
+      rescue Errno::ENOENT
+        false
+      end
+      tracked && File.read(File.join(dir, 'stat')).split(') ').last.split[19] == start
+    end
+
+    def self.pins_known?
+      referenced_session_ids
+      true
+    rescue StandardError
+      false
+    end
+
+    # Cleanup preserves evidence referenced by all retained learning, mistake
+    # and durable memory records, not just the ordinary gold/open/hot pins.
+    def self.referenced_session_ids
+      references = PWN::Sessions.dependency_index
+      raise 'Uncertain dependency stores' unless references[:errors].empty?
+
+      references[:dependencies].keys
+    end
+
+    # Fingerprints include inode identity and nanosecond timestamps, not bodies.
+    def self.snapshot(path)
+      [path, path.sub(/\.jsonl\z/, '.meta.json')].to_h do |file|
+        raise 'Refusing symlink' if File.symlink?(file)
+        next [File.basename(file), nil] unless File.exist?(file)
+
+        stat = File.stat(file)
+        raise 'Not a regular file' unless stat.file?
+
+        [File.basename(file), { sha256: Digest::SHA256.file(file).hexdigest, size: stat.size, inode: stat.ino, device: stat.dev, mtime: stat.mtime.to_r.to_s, ctime: stat.ctime.to_r.to_s }]
+      end
+    end
+
+    def self.publish(path, bytes)
+      temporary = "#{path}.#{SecureRandom.hex(8)}.tmp"
+      File.open(temporary, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+        file.write(bytes)
+        file.flush
+        file.fsync
+      end
+      File.rename(temporary, path)
+      File.open(File.dirname(path), File::RDONLY, &:fsync)
+    ensure
+      File.unlink(temporary) if temporary && File.exist?(temporary)
+    end
+
+    def self.backup(path, expected, result)
+      unless result[:archive_dir]
+        base = File.join(Dir.home, '.pwn', 'session_cleanup_archive')
+        raise 'Unsafe archive directory' if File.symlink?(base)
+
+        FileUtils.mkdir_p(base, mode: 0o700)
+        raise 'Unsafe archive permissions' unless File.stat(base).uid == Process.uid && (File.stat(base).mode & 0o777) == 0o700
+
+        result[:archive_dir] = File.join(base, "#{Time.now.utc.strftime('%Y%m%dT%H%M%S')}-#{SecureRandom.hex(8)}")
+        Dir.mkdir(result[:archive_dir], 0o700)
+      end
+      expected.each do |name, record|
+        next unless record
+
+        source = File.join(File.dirname(path), name)
+        bytes = File.binread(source)
+        raise 'Changed before backup' unless Digest::SHA256.hexdigest(bytes) == record[:sha256]
+
+        target = File.join(result[:archive_dir], name)
+        publish(target, bytes)
+        raise 'Backup verification failed' unless Digest::SHA256.file(target).hexdigest == record[:sha256]
+      end
+      publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
+    end
+
+    def self.run(dry_run: true, current_session_id: nil, proc_root: '/proc')
+      raise 'Session cleanup requires the updated Sessions activity API; load the updated source or deploy it before running this helper' unless PWN::Sessions.respond_to?(:activate)
+
+      root = PWN::Sessions.sessions_dir
+      raise 'Refusing symlinked session directory' if File.symlink?(root)
+
+      current = current_session_id || (PWN::Env.dig(:ai, :session_id) if defined?(PWN::Env))
+      legacy = legacy_owners(proc_root)
+      result = { version: VERSION, dry_run: dry_run, scanned: 0, unnamed: 0, candidate_ids: [], deleted_ids: [], records: [], skipped: Hash.new(0), legacy_owners: legacy }
+      unless pins_known?
+        result[:skipped][:unknown_pins] = 1
+        result[:dependency_errors] = PWN::Sessions.dependency_index[:errors]
+        return result
+      end
+      dependencies = PWN::Sessions.dependency_index[:dependencies]
+      pins = referenced_session_ids
+      Dir.glob(File.join(root, '*.jsonl')).each do |path|
+        id = File.basename(path, '.jsonl')
+        result[:scanned] += 1
+        state = classify(path, id)
+        record = PWN::Sessions.title_status(session_id: id).merge(id: id, classification: state, dependencies: dependencies.fetch(id, []))
+        result[:records] << record
+        unless state == :unnamed
+          result[:skipped][state] += 1
+          next
+        end
+        expected = snapshot(path)
+        record[:files] = expected
+        result[:unnamed] += 1
+        if PWN::Sessions.active?(session_id: id)
+          record[:skip] = :active
+          result[:skipped][:active] += 1
+          next
+        end
+        if id == current || pins.include?(id)
+          reason = id == current ? :current : :referenced
+          record[:skip] = reason
+          result[:skipped][reason] += 1
+          next
+        end
+        result[:candidate_ids] << id
+        record[:apply_blocked_by] = :unknown_legacy_ownership unless legacy.empty?
+        next if dry_run
+
+        unless legacy.empty? && legacy_owners(proc_root).empty?
+          record[:skip] = :unknown_legacy_ownership
+          result[:skipped][:unknown_legacy_ownership] += 1
+          next
+        end
+        # Never unlink lock files: waiters must keep sharing the same inode.
+        lock_path = File.join(root, ".#{id}.cleanup.lock")
+        raise 'Refusing symlinked cleanup lock' if File.symlink?(lock_path)
+
+        File.open(lock_path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) do |lock|
+          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+            result[:skipped][:locked] += 1
+            record[:skip] = :locked
+            next
+          end
+          File.open(path, File::RDONLY | File::NOFOLLOW) do |transcript|
+            unless transcript.flock(File::LOCK_EX | File::LOCK_NB)
+              result[:skipped][:locked] += 1
+              record[:skip] = :locked
+              next
+            end
+            # Activation and deletion serialize on the same per-session inode.
+            # Legacy ownership uncertainty still requires operator migration.
+            unless File.identical?(transcript, path) && classify(path, id) == :unnamed && snapshot(path) == expected && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
+              result[:skipped][:changed] += 1
+              record[:skip] = :changed
+              next
+            end
+            backup(path, expected, result)
+            unless snapshot(path) == expected && classify(path, id) == :unnamed && legacy_owners(proc_root).empty? && pins_known? && !referenced_session_ids.include?(id)
+              result[:skipped][:changed] += 1
+              record[:skip] = :changed
+              next
+            end
+            # Only verified, archived, unreferenced unsummarized sessions;
+            # current and all known reference pins checked above.
+            # The normal delete API's age pin is deliberately bypassed here.
+            PWN::Sessions.delete(session_id: id, current_session_id: current, force: true, cleanup_lock: lock)
+            raise 'Deletion did not remove both session records' if File.exist?(path) || File.exist?(path.sub(/\.jsonl\z/, '.meta.json'))
+
+            result[:deleted_ids] << id
+            record[:deleted] = true
+            publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result))
+          end
+        end
+      rescue StandardError => e
+        result[:skipped][:error] += 1
+        record[:error] = e.class.name if record
+      end
+      publish(File.join(result[:archive_dir], 'ledger.json'), JSON.pretty_generate(result)) if result[:archive_dir]
+      result
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  raise 'Use --dry-run or --apply' unless ARGV.length == 1 && %w[--dry-run --apply].include?(ARGV.first)
+
+  puts JSON.generate(PWN::SessionCleanup.run(dry_run: ARGV.first == '--dry-run'))
+end

data/etc/default_skills/pwn/ai/agent/learning/SKILL.md

@@ -28,11 +28,17 @@ Class methods take `(opts = {})` and read `opts`.
 
 ```ruby
 PWN::AI::Agent::Learning.help
-PWN::AI::Agent::Learning.note_outcome(opts)
+PWN::AI::Agent::Learning.evidence_transcript(opts)
 ```
 
 ## Public methods
 
+- `evidence_transcript`
+- `session_evidence`
+- `evidence_complete`
+- `migrate_evidence`
+- `annotate_evidence`
+- `rollback_evidence`
 - `note_outcome`
 - `consistency_check`
 - `disputed_save`
@@ -63,6 +69,7 @@ PWN::AI::Agent::Learning.note_outcome(opts)
 - `authors`
 - `help`
 - `compact!`
+- `evidence_complete?`
 - `gc_stores!`
 - `lean!`
 - `prune_outcomes!`
@@ -74,5 +81,5 @@ PWN::AI::Agent::Learning.note_outcome(opts)
 
 ## Verification
 
-`PWN::AI::Agent::Learning.respond_to?(:note_outcome)` after the
+`PWN::AI::Agent::Learning.respond_to?(:evidence_transcript)` after the
 module is loaded. Read the source for parameter names.